sqladmin CVE-2026-46645
MEDIUM
GHSA-54mc-gghv-4cfj
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
Impact
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint - silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=<field>&term=<query>
All other endpoints enforce both checks:
| Endpoint | @login_required | is_accessible() |
|---|---|---|
list | ✓ | ✓ |
create | ✓ | ✓ |
edit | ✓ | ✓ |
delete | ✓ | ✓ |
details | ✓ | ✓ |
export | ✓ | ✓ |
ajax_lookup (before fix) | ✗ | ✗ |
ajax_lookup (after fix) | ✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator - unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Patches
Two changes were made to ajax_lookup:
- Replaced the hand-rolled authentication check added in #1035 with the standard
@login_requireddecorator used by all other endpoints. - Added the missing
is_accessible(request)check, raisingHTTP 403when it returnsFalse.
Workarounds
None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
AnalysisAI
{identity}/ajax/lookup enforced neither prior to patching. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today